Google Workspace

cbarrios — Fri, 26 Jan 2024 14:57:06 GMT

Hello Every Body.

I'm starting this question be couse i'm traying to genrate detections for goole workspace invader as that post about 365.

https://www.splunk.com/en_us/blog/security/hunting-m365-invaders-blue-team-s-guide-to-initial-access-vectors.html.

But i can not find google work space login logs in actual ingest. We installed the ad-don and newest apps abalaible in the splunkbase and could not find it.

surfin into the splunk web we could't fund an euivalent searchs as the link attached.

Some bady had the same problem? how can I solved it?

Re: Google Workspace

datadevops — Sun, 28 Jan 2024 10:14:45 GMT

Hi there,

The key is finding those Workspace login logs. While the add-on and apps might be installed, there could be a filtering or indexing issue.

Here's a quick rundown:

Check the filter: Did you configure any filters that might exclude login events? Double-check your inputs.conf settings specifically.
Look for indexing errors: Splunk logs might reveal indexing errors related to Workspace data. Check splunkd.log and python.log for clues.
Search smarter: The provided search might not translate perfectly to Workspace. Try broader terms like "google login" or "workspace access" and adjust from there.

If you're still stuck, I recommend searching Splunkbase forums or reaching out to Splunk or Google Workspace support directly. They've seen it all and can offer specific guidance.

Remember, hunting invaders is like being a detective – persistence and resourcefulness are key!

~ If the reply helps, a Karma upvote would be appreciated

topic Re: Google Workspace in Security

Google Workspace

Re: Google Workspace